Privacy Policy

MyChoice · MyAPT · MyEscape

Version 1.0 · Effective date: [EFFECTIVE DATE]

Contents

1. Who we are and what this Policy covers
2. Personal data we collect
3. Why we use personal data, and our legal bases
4. Sharing inside Workspaces
5. Who else receives personal data
6. Import tools: the browser extension and AI
7. Cookies and similar technologies
8. International transfers
9. How long we keep personal data
10. Security and data breaches
11. Your rights and choices
12. Children
13. People named in Content, and professional use
14. Automated decision-making
15. Changes to this Policy
16. Contact, Data Protection Officer and complaints

1. Who we are and what this Policy covers

1.1 Who we are. MyChoice is operated by [LEGAL ENTITY NAME] (UEN / registration number: [REGISTRATION NUMBER]), whose address is [REGISTERED ADDRESS] ("we", "us", "our"). We decide why and how personal data is used for the Service. We are the "controller" under the GDPR and an "organisation" under the PDPA.

1.2 What this Policy covers. This Privacy Policy (the "Policy") explains how we collect, use, disclose and protect personal data when you use the Service (our websites and applications, the "Save to MyChoice" browser extension and the product editions MyAPT and MyEscape) or contact us. It applies together with our Terms of Service at https://my-choice.io/terms (the "Terms") and our Cookie Policy at https://my-choice.io/cookies (the "Cookie Policy"). Words that start with a capital letter have the meaning given in the Terms.

1.3 Laws that apply. We handle personal data in line with the Personal Data Protection Act 2012 of Singapore (the "PDPA") and, where they apply to you, the European Union General Data Protection Regulation and the United Kingdom GDPR (together, the "GDPR").

1.4 Personal data. "Personal data" means any data about an individual who can be identified from it, alone or with other information.

2. Personal data we collect

2.1 What we collect. We collect personal data that you give us, that we collect when you use the Service, and that we receive from others (for example Google when you sign in with Google, other Members of your Workspaces, and the listing websites you import from).

2.2 Sensitive data. We do not ask for sensitive personal data (such as health, religion, sexual orientation, political opinions or government identity numbers), and the Service is not designed for it. Please do not add it. If you choose to add it, you do so on your own initiative, and we process it only to store it and show it to you and to the Members you choose.

2.3 What you must provide. To create an account you must give us an email address and a password, or sign in with Google. Without them we cannot provide the Service. Everything else is optional, although some features need it: travel times, for example, need at least one key address.

3. Why we use personal data, and our legal bases

3.1 Purposes and GDPR legal bases.

3.2 PDPA. Under the PDPA we collect, use and disclose personal data with your consent. That includes consent deemed to be given because you voluntarily provide data for a purpose that we have told you about in this Policy, or because the data is necessary to provide the Service you asked for. We also rely on the exceptions that the PDPA allows, such as legitimate interests (for example keeping the Service secure), business improvement purposes (for example analysing aggregated usage to improve the Service) and legal requirements.

3.3 Legitimate interests. Where we rely on legitimate interests, we have weighed them against your rights and interests. You can object to this use (see Section 11).

3.4 Withdrawing consent. Where we rely on your consent, you can withdraw it at any time by writing to us (see Section 16). We will tell you what this means for your use of the Service. Withdrawal does not affect what we did before.

3.5 New purposes. We will not use your personal data for a new purpose that differs materially from those above without telling you and, where the law requires, asking for your consent.

4. Sharing inside Workspaces

4.1 What other Members see. A Workspace is shared. The other Members can see what you add to it, including Items, notes, ratings, scores and information that identifies you inside the Workspace, such as your name. Their access depends on their role (Viewer, Contributor or Owner).

4.2 Notifications to Owners. When someone joins a Workspace, we email its Owners. The notification identifies the new Member.

4.3 Invitation links. Anyone who opens a valid invitation link can join the Workspace with the role attached to that link. Share links with care and only with people you trust.

4.4 When you leave. If you leave a Workspace or close your account, what you contributed may remain in the Workspace so that the group's comparisons stay coherent. We remove your name and other identifiers from those contributions. You can also ask us to delete them (see Section 11).

5. Who else receives personal data

5.1 Service providers. We use providers that process personal data on our behalf, under written terms that allow them to use it only to provide their service to us and require them to protect it (as "processors" under the GDPR and "data intermediaries" under the PDPA). Today they include:

Google, when you sign in with Google, acts for itself and not for us. Its handling of your Google account data is covered by Google's own privacy policy. We may change providers. We will update this list when we do.

5.2 Other recipients. We may also disclose personal data:

• to the other Members of your Workspaces, as Section 4 explains;
• to authorities, courts and others, where the law requires it or where we need to establish, exercise or defend legal claims;
• to professional advisers, insurers and auditors, under a duty of confidentiality;
• to a buyer or investor, and their advisers, in connection with a merger, acquisition, financing or sale of assets, subject to confidentiality and with notice to you where the law requires it.

5.3 What we do not do. We do not sell personal data, and we do not use it for advertising or share it with advertisers. We may use aggregated and de-identified data as the Terms explain.

6. Import tools: the browser extension and AI

6.1 Browser extension. The extension runs on pages it recognises as listings so that it can show a "Save to MyChoice" button. When you click the button, it sends the page you are viewing to our servers, using your signed-in session with us, so that we can create an Item. That page can include personal data that is displayed to you on it. We use it to extract the details and photos of the listing. The extension does not need your passwords for other websites. Please do not use it on pages that show sensitive personal data. You can remove the extension at any time.

6.2 Links you paste. When you paste a link, we may retrieve the page directly or through a page-retrieval provider.

6.3 AI-assisted extraction. We first use the structured data published on a page, then website-specific parsers. We use an AI model only when required details are still missing, and then we send it only the cleaned text of the page, not your account data or the rest of your Content. Our AI provider processes that text on our behalf. We do not use your Content to train AI models, and we configure and contract our AI provider so that the content we send is not used to train its models. The extracted details are shown to you so that you can check them.

7. Cookies and similar technologies

7.1 Our Cookie Policy. Our Cookie Policy at https://my-choice.io/cookies lists every cookie and similar technology we use, and explains how we ask for and record your choices. This Section summarises it.

7.2 Essential cookies. We use a small number of essential first-party cookies: a secure session cookie that keeps you signed in and protects the Service against abuse, a cookie that remembers the Workspace you last opened, a short-lived cookie that protects "Sign in with Google", and a cookie that remembers your cookie choices. The Service cannot work without them, and they do not need your consent.

7.3 Optional map statistics. The only optional technology is the usage statistics collected by the map software of Mapbox, which stores a random identifier in your browser. Depending on where you are, it stays off until you accept it, or stays on until you switch it off, as the Cookie Policy explains. A Global Privacy Control signal counts as a refusal. When a map is displayed, your browser also connects to Mapbox, which receives technical data such as your IP address and handles it under its own privacy policy.

7.4 No advertising cookies; measurement without cookies. We do not use advertising cookies, analytics cookies or tracking across other websites. We measure audience and performance in aggregate with Vercel Web Analytics and Speed Insights, which set no cookies and store nothing on your device. If we add any optional technology, we will update the Cookie Policy and this Policy and, where the law requires it, ask for your choice first.

7.5 Your choices and your browser. You can change your choices at any time with "Cookie settings" at the bottom of our pages or in your account. You can also block cookies in your browser settings, but then you will not be able to sign in.

8. International transfers

8.1 Where data may go. Our providers, and members of our team, may process personal data in countries other than yours, including Singapore and the United States.

8.2 Safeguards. When personal data is transferred out of Singapore, we make sure that the recipient provides a standard of protection comparable to the PDPA, for example through a contract. When personal data covered by the GDPR is transferred outside the European Economic Area or the United Kingdom, we rely on an adequacy decision or on safeguards such as the standard contractual clauses approved by the European Commission. You can ask us for information about these safeguards (see Section 16).

9. How long we keep personal data

9.1 Principle. We keep personal data only as long as we need it for the purposes in this Policy, or as the law requires. Then we delete it or anonymise it.

9.2 Periods.

10. Security and data breaches

10.1 Our measures. We protect personal data with reasonable technical and organisational measures. They include encryption of data in transit (HTTPS), passwords stored only as salted hashes, session cookies that scripts cannot read, access controls based on roles, and access to personal data limited to people and providers who need it.

10.2 No perfect security. No system is perfectly secure, and we cannot guarantee that unauthorised access will never occur.

10.3 Breaches. If a personal data breach occurs that the law requires us to report, we will notify the Personal Data Protection Commission of Singapore, the competent authorities in other countries and the people affected, within the time the law requires.

10.4 Your part. Choose a strong, unique password and keep your invitation links and your Google account secure.

11. Your rights and choices

11.1 Your rights. Depending on where you live, you can ask us to:

• access the personal data we hold about you and how we use it;
• correct data that is inaccurate or incomplete;
• delete your data, including by closing your account;
• restrict our use of your data in some cases;
• object to uses based on our legitimate interests;
• withdraw consent where we rely on it;
• give you a copy of the data you provided, in a common electronic format, and, where the GDPR applies, ask us to transmit it to another provider;
• not be subject to decisions based solely on automated processing that significantly affect you (see Section 14).

11.2 How to use them. Write to [LEGAL EMAIL]. Some actions, such as closing your account, may also be available in your account settings. We may need to verify your identity first, and we will not ask for more than we need to do so.

11.3 Our response. We answer within 30 days. If we need more time, or if the law allows us to extend the period, we will tell you why. We do not charge for requests. Where the PDPA allows it, we may charge a reasonable fee for an access request, and we will tell you the amount before we act.

11.4 Limits. We may refuse or limit a request where the law allows, for example if it is manifestly unfounded or excessive, if it would affect the rights of others, or if we must keep the data by law. We will tell you why.

11.5 Shared Workspaces. If you ask us to delete your account, we delete your personal data and anonymise your contributions to Workspaces that continue to exist, as Sections 4.4 and 9.2 explain. If you own a Workspace that others use, transfer it or delete it first, where the Service allows.

11.6 Complaints. You can complain to a data protection authority (see Section 16). We would like the chance to help first.

12. Children

The Service is designed for people making important decisions and is not directed at young children. A minor may use the Service only with the permission of a parent or legal guardian, as the Terms explain. We do not knowingly collect personal data from a child without the parental consent that the law requires. If you believe that a child has given us personal data without that consent, write to [LEGAL EMAIL] and we will delete it. A parent or guardian can also ask to access or delete a child's data.

13. People named in Content, and professional use

13.1 People named in Content. Users may add personal data about other people to their Content, for example the name or phone number of an agent or a landlord shown in a listing. We process this data on the instructions of the user and for our legitimate interests in running the Service. This Policy is our notice to those people. A person who is named in Content can write to [LEGAL EMAIL] to ask for access, correction or deletion, and we will handle the request as the law requires.

13.2 Professional use. If you use the Service in a professional capacity and add personal data about your clients, you decide why and how that data is used, and we process it on your behalf. You are responsible for having the authority, and any notice or consent the law requires, to add it (see Section 3.7 of the Terms). Write to us if you need data processing terms.

14. Automated decision-making

We do not make decisions about you based solely on automated processing that have legal effects or similarly significant effects on you. Scores and rankings are calculated from the ratings and weightings that you and the other Members enter. They are an aid for your own decision.

15. Changes to this Policy

We may update this Policy, for example when the Service, the law or our providers change. The version number and effective date are shown at the top. For material changes we will give you at least 14 days' notice, by email or inside the Service, before they take effect. Changes required by law or by security needs may take effect immediately. Where the law requires your consent to a change, we will ask for it.

16. Contact, Data Protection Officer and complaints

16.1 Data Protection Officer. We have designated a Data Protection Officer. You can reach them at [LEGAL EMAIL], with "Privacy" in the subject line, or by post at:

[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]

16.2 Representatives in the EU and the UK. Our representative in the European Union and in the United Kingdom, appointed under Article 27 of the GDPR, is [EU REPRESENTATIVE NAME AND ADDRESS].

16.3 Complaints. You can complain to the Personal Data Protection Commission of Singapore. If you live or work in the European Economic Area or the United Kingdom, or if you believe that the GDPR has been infringed there, you can also complain to the data protection authority of your country. We would like the chance to help first, so please write to us.

16.4 Language. This Policy is available in English and in French. If the two versions differ, the English version prevails, except where mandatory law requires that the version in your language prevails.